LNK Stomping: Attackers Bypass Windows Security by Stripping the ‘Mark of the Web’

LNK Stomping is a technique disclosed in 2024 by Elastic Security Labs and later detailed by AhnLab researchers, which abuses Windows Explorer’s path normalisation to bypass the Mark of the Web (MoTW) and its protections. The vulnerability, tracked as CVE-2024-38217, can allow a malicious LNK file to shed its MoTW warning during the canonicalisation process, enabling payloads to run without SmartScreen or SAC intervention.

AhnLab describes several abnormal structures attackers can use, such as PathSegment Type, Dot Type, and Relative Type, to manipulate the target path and trigger the bypass under Windows 10 with SAC and SmartScreen enabled. Public samples cited by Joe Desimone of Elastic Security Labs show LNK Stomping patterns on VirusTotal, with the oldest submission dating back six years as of 6 August 2024. The CVE was added to the CISA KEV catalog on 10 September 2024, underscoring active abuse in the wild. According to AhnLab, attacks abusing LNK files have become a persistent threat rather than a one-time trend.